[dnlrsls]

Linked issue

Closes #3

Follow-up to the already completed discovery contract. The issue stays closed; its status:approved label was explicitly authorized for this follow-up. This does not close or change the deferred controlled-verification work.

PR type

• Bug fix
• New feature
• Documentation only
• Code refactoring
• Maintenance/tooling
• Breaking change

Summary

• Stop discovery at descendant .git entries using confined metadata only; preserve explicitly selected roots and ordinary nested packages.
• Keep omission/UNKNOWN evidence, finite budgets and no-execution behavior; never read marker payloads or follow gitdir pointers.
• Preserve conditional root bootstrap proposals while blocking excluded ancestors and the exact draft destination; other incomplete reads still block.

Changes

Surface	Change
internal/discovery/snapshot.go and tests	Repository-marker boundary before descendant enumeration or manifest reads.
internal/bootstrap/bootstrap.go	Distinguish intentional out-of-scope repositories from unsafe root reads; protect the destination itself.
cmd/ci-trust/discovery_scope_test.go	Public canonical reports, exact streams/exits, unchanged fixtures/counters, ordinary packages, ancestor/exact destination guards.
docs/discovery.md, docs/bootstrap.md	Boundary and limitations; no complete-coverage guarantee.

Test plan

• Standalone PR tree: go test -count=1 ./... and go vet ./... passed in an isolated canonical archive.
• Genuine public regression RED before the exact-destination guard, GREEN after; independent blocker-only recheck passed.
• Owned public-interface assertions cover exact stdout/stderr/exit, repeated canonical JSON and fixture/counter immutability.
• Source refs/dependencies preserved; no audited scripts, Node, controlled runtime, dependencies, CI or release changes.

Remote Linux/Windows/macOS execution is required through this PR's checks; local Windows checks are not portable-execution proof. Marker-inspection error handling was source-inspected, not fault-injected; nonverbose historical symlink skip status was not established. Native assessment was unassessable, not approval; independent source verification ran.

Contributor checklist

• Linked an approved issue and selected exactly one matching type:* PR label.
• Tests and docs accompany behavior; Conventional Commit messages, no Co-Authored-By trailers.
• Shellcheck / agent-skill testing: N/A, no shell scripts or skills changed.
• No private task cards, local evidence, target paths or raw pilot reports included.

Chain Context

Field	Value
Chain	Offline audit scope and readable uncertainty
Tracker PR	Not needed: stacked PRs selected
Position	1 of 2
Base	main at b16b7cbff841239d493e308802849f02395bef56
Depends on	None
Follow-up	feat/audit-review-summary
Review budget	222 changed lines / 400
Starts at	Published offline-auditor source
Ends with	Independently testable repository boundary plus safe bootstrap behavior

main
 └── 📍 fix/audit-repository-boundaries (this PR)
      └── feat/audit-review-summary (follow-up)

Includes reader/bootstrap behavior, tests and docs. Excludes summary presentation, broad copied-directory inference, runtime execution and releases. Roll back this unit independently. Review only; no automatic merge, rebase, squash or branch deletion. The follow-up can be retargeted after a later authorized merge commit, without rewriting original history.

Risk: item 3 (shared snapshot and bootstrap contracts).